Name: security-and-compliance-best-practices
Author: Larrybin

Instruction file imported from Larrybin/saas_template (.cursor/rules/security-and-compliance-best-practices.mdc). Copyright stays with the author.

description: Security and compliance rules for auth, payments, storage and logging globs: .ts,.tsx alwaysApply: false

Use better-auth and the ensureApiUser helper as the single entrypoint for authenticating API requests; do not hand-roll cookie or session parsing.
Keep all Stripe secret keys and sensitive configuration on the server; never expose them via NEXT_PUBLIC_* or in client-side code.
For Stripe webhooks, always verify signatures using the raw request body with stripe.webhooks.constructEvent and design idempotent handlers keyed by event id.
Use the centralized storage upload API (/api/storage/upload) and validate file size, MIME type, and folder paths on the server; ensure paths include user identifiers for isolation.
Avoid logging or sending to analytics any sensitive data such as passwords, tokens, full card numbers, or URLs containing secrets.
When returning errors to the client, provide structured error codes and user-friendly messages, but avoid leaking stack traces or internal implementation details.

{ "ocm": "1", "id": "larrybin-saas-template-security-and-compliance-best-prac-6b0e9b", "kind": "skill", "name": "security-and-compliance-best-practices", "description": "description: Security and compliance rules for auth, payments, storage and logging globs: *.ts,*.tsx alwaysApply: false ---", "publisher": "Larrybin", "version": "1.0.0", "capabilities": { "domains": [ "legal" ], "tags": [ "skill-md", "github-cursor-rules" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "description: Security and compliance rules for auth, payments, storage and logging globs: *.ts,*.tsx alwaysApply: false ---" ], "primary": false, "metadata": { "source": { "provider": "github-cursor-rules", "repository": "https://github.com/Larrybin/saas_template", "path": ".cursor/rules/security-and-compliance-best-practices.mdc", "ref": "8daf3c495873958c829fe72da6ff3fa654344c36", "url": "https://github.com/Larrybin/saas_template/blob/8daf3c495873958c829fe72da6ff3fa654344c36/.cursor/rules/security-and-compliance-best-practices.mdc", "key": "Larrybin/saas_template/.cursor/rules/security-and-compliance-best-practices.mdc" } }, "instructions": "---\ndescription: Security and compliance rules for auth, payments, storage and logging\nglobs: *.ts,*.tsx\nalwaysApply: false\n---\n\n- Use better-auth and the `ensureApiUser` helper as the single entrypoint for authenticating API requests; do not hand-roll cookie or session parsing.\n- Keep all Stripe secret keys and sensitive configuration on the server; never expose them via `NEXT_PUBLIC_*` or in client-side code.\n- For Stripe webhooks, always verify signatures using the raw request body with `stripe.webhooks.constructEvent` and design idempotent handlers keyed by event id.\n- Use the centralized ", "cost": { "context_tokens": 265 } }

security-and-compliance-best-practices

About

description: Security and compliance rules for auth, payments, storage and logging globs: .ts,.tsx alwaysApply: false

Use it

Manifest

Reviews